The GOVENANT Standard — Part 8: The Constitution Plane

The human is a constitutional layer above the action path — it steers, it never gates. Every setting is a row with provenance; a human edit locks the key against agent overwrite; proposals auto-commit through objection windows so governance never becomes the bottleneck. The plane must be able to prove, for any knob, who set it, when, and what it was before — or the constitution is a story, not a record.

8.1 Settings as rows, with provenance

CREATE TABLE bos_config (
  scope_kind TEXT NOT NULL DEFAULT 'tenant', scope_id TEXT,
  key TEXT NOT NULL,
  value TEXT NOT NULL,
  source TEXT NOT NULL CHECK (source IN ('default','agent','boardroom','human')),
  set_by TEXT, set_at TEXT NOT NULL,
  PRIMARY KEY (scope_kind, scope_id, key)
);

-- APPEND on every write — never updated, never skipped. The constitution's memory.
CREATE TABLE config_snapshots (
  id TEXT PRIMARY KEY,
  scope_kind TEXT, scope_id TEXT, key TEXT NOT NULL,
  old_value TEXT, new_value TEXT NOT NULL,
  source TEXT NOT NULL, set_by TEXT, set_at TEXT NOT NULL
);

Precedence (the sticky lock):

human > boardroom > agent > default

A human write locks the key: no agent or boardroom write can overwrite it, ever, until a human unlocks it. The lock is enforced in setConfig() — the chokepoint — not requested of agents.
Provenance must be truthful. The reference audit found agent-driven boardroom commits stamped source='human' — which makes the lock unenforceable and the provenance a lie. Each writing surface stamps its own source; nothing “borrows” human authority. (This is why boardroom is a distinct source: deliberation-committed values must be distinguishable from human edits and from unilateral agent writes.)
Every write appends a snapshot (AP-4: INSERT ... ON CONFLICT DO UPDATE silently destroyed all config history while a zero-row snapshots table looked on). Resolution reads bos_config; history reads config_snapshots; the two must reconcile.

8.2 The five constitutional powers

All five surfaced in the UI as a daily-usable console — not buried admin toggles:

Power	Mechanism	Governance property
1 · Approve / reject	The approval queue (Part 4 S7) for Tier-2 acts.	The human authorizes what hasn’t earned autonomy.
2 · Issue a directive	A strategic mandate, recorded as a row, translated by the addressed role into an owned-lever pull — or routed as a request when the lever belongs to someone else (never silently downgraded to advice).	Human intent enters the same gauntlet as everything else.
3 · Objection window	Proposals auto-commit after N hours unless vetoed — only for owned levers, only with valid parameters, never stale ones.	The human can always intervene but is never required to — deliberation never gates actuation.
4 · Lock a key	The sticky lock (§8.1) — including prompts, rosters, rules, and grants (they are all config).	Durable human override, machine-checkable.
5 · Reorganize	Rename a role, reassign a lever, cap a budget, pause an agent/tenant, set an autonomy mode — all runtime config writes.	The org chart is data; the human can restructure without a deploy.

8.3 Pause semantics

Pause is a true no-op with a receipt: a paused agent’s trigger fires, the shared run-wrapper gates it, and a skipped(reason='paused') row is written — so pause is auditable, the liveness monitor knows not to alarm (Part 7 §7.3), and coverage math counts it as a reasoned miss, not silence. Pause enforcement lives in the one wrapper every agent run passes through — per-agent implementations will miss agents (the reference covered 4 of 16).

8.4 Directives end-to-end

flowchart LR H[Human directive\nrecorded as a row] --> C{Addressed role\nowns the lever?} C -- yes --> P[Owned-lever pull\nthrough the gauntlet Part 5] C -- no --> R[executive_request\nto the owning role] P --> L[Ledgered with falsifiable\nprediction Part 6] R --> L

A directive lane with zero rows means the humans are steering out-of-band (Slack, verbal, code edits) — which is un-audited constitutional power. Wire the natural human surfaces (boardroom “CEO asks”, review sessions) to emit directive rows, or the plane records only the machine’s half of the constitution.

8.5 What the plane must survive (probes)

The sticky-lock write test: agent-write over a human-set key must fail, and the failure must be observable (a refusal row, not a silent success).
The provenance test: sample source='human' rows; verify each traces to an actual human surface (UI action, signed API call). Agent-stamped-as-human = CRITICAL.
The history test: config_snapshots grows on every write; pick 3 knobs and reconstruct their history.
The pause test: pause an agent, fire its trigger, find the skipped(paused) receipt.
The off-domain directive test: direct a role to pull a lever it doesn’t own — must route as a request, not execute, not evaporate.